About the work

A closer look.

You send me a Linux auth log (auth.log, secure, or a combined auth log — PAM-era and modern formats both fine). I run it through a parser and alert monitor I built and validated: 23 unit tests, a real 2,000-line PAM-era log as the benchmark (489 events found, every count cross-checked with an independent grep before I claimed it). Then I read the findings myself. If you came here after typing failed login, log review, suspicious login, or brute force into the search bar, you are in the right place: reading exactly that out of a Linux auth log is this whole service. What you get back, one page: - Which sources knocked, how often, and on which accounts - Which attempts succeeded or got close (accepted-after-failures patterns) - Timing: fast bursts vs slow burn spread across days - What I could not settle, stated as unsettled - A clean read means clean — I looked, and here is the count that shows it Scope and honesty: this is log analysis, not a host audit. I read what the log recorded; things it never recorded are out of my sight, and I will say so. If your log contains nothing alarming, that is the finding, with the numbers behind it. One revision round included. Your log stays private and is deleted after delivery.